Naoki Hiroshima tells how he lost his rare Twitter handle @N, worth about $50,000, through social engineering of his account providers.
HN links it as a warning about domain registrar and account security, especially when discussing hijacking, registrar trust, and social engineering.
Surprised not to see Apple's Hide My Email mentioned. I was moving towards using my_email+short_company_name@my_domain when it was released.
I found problems with the + syntax occasionally, where I could sign up with that address but wasn't able to log in because their code stripped the + or the + and anything after that.
Now I do 3 levels:
1) use Hide My Email with most companies
2) use me@my_domain with people I want to talk to
3) use my gmail address with Advanced Protection for really important things.
I was going to use my_domain for really important things but it has 2 attack surfaces (registrar and Apple (I use their MX service)) whereas Gmail only has one. And there was an old (2014) article [0] here posted recently about how someone lost their Instagram handle because somebody social engineered GoDaddy into giving the attacker control of the person's domain.
[0] https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd
I've read a number of stories on the topic - the basic technique is to identify the domain registrar or DNS provider and attempt to manually reset the password by spear-phishing with the customer service rep. Once you're in, MX can be redirected to a host of the attacker's choice, and then you can initiate password resets on any number of third-party services.
One example of a DNS-based MX hijack is http://arstechnica.com/security/2015/02/attackers-take-control-of-lenovo-com-hijacking-e-mail-and-web-servers/ although i'm at a loss to come up with some more specific (and exciting!) examples that i can clearly remember.
It's a vulnerability that simply doesn't exist with gmail/hotmail/outlook.com addresses. Do you know whether your domain registrar and DNS providers' CSRs mandate 2FA or allow multiple attempts at guessing security questions?
EDIT: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd used the same attack.
Leveraging an email to steal anything is nothing new. If this is arguably a revelation, I should start asking this as an interview question. Also, the author never explicitly mentions to secure your email address.
In the 2000s, domain hijackings were very common (as tedunangst mentioned):
http://www.metafilter.com/3789/Adobecom-gets-hijacked
http://archive.wired.com/politics/law/news/2000/04/35674?currentPage=all
Later on, it became short Twitter accounts:
https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd#.7rf3w1iqi
https://www.wired.com/2016/06/deray-twitter-hack-2-factor-isnt-enough/
If your metric is how informative an article is, the above two links about Twitter accounts being hijacked are much more educational than original blogpost.
> Somehow, the attacker got KVM access credentials for the server. [...] After he got KVM access, the attacker convinced NFOrce that he was me (using his KVM access as part of his evidence) and said that he had locked himself out of the server. So NFOrce reset the server's root password for him, giving him complete access to the server and bypassing most of our carefully-designed security measures...
Ugh. We need to remember that social engineering your ISP, hosting provider, etc. is a very real attack vector. Do not trust them.
Reminds me of the "N" twitter username story:
https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd
I use AWS registrar, primarily because I trust in their security policies. I recall the plight of the owner of the N twitter handle[0] and I do not believe it should be possible to talk AWS into phishing a domain from an AWS account, which is my primary concern. I have always felt their security procedures to be top-notch whenever I have dealt with them in this way, having used AWS for over 10 years. With other registrars I do not know how good their policies are.
[0] https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd
From ICANN's perspective though, doesn't that mean that the owner of the domain is the registrar?
While most registrars would be perfectly fine, I worry about the one that is willing to take the domain for themselves (for a domain not worth going to court over).
While not exactly what happened, I remember the case of the @N twitter account be stolen (https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd), and wonder if having your actual information on the registration would help or hurt a situation like that.